passenger 5.1.10 → 5.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4e20b037aaef74394247443777fc16afe26f0691
-  data.tar.gz: bddc866fe0e4e2d56805e70904bb3b7c3a50fb5e
+  metadata.gz: 1dcd88ceab959baa6975ea6d4305a925af272321
+  data.tar.gz: 44883c1837663f92487534c6069ba313a53062d8
 SHA512:
-  metadata.gz: '0585c5cb8e3313c4d6c85a134f7f212dd32b0553c4a22ec806502af8baa0f83c77530dfbcc8d3ae25a42adafa8cea3f329c9444f9e7e6435f7063365b7587d66'
-  data.tar.gz: 8d3054d1a05cd1fcff2ef2802e612dc72ba78d0529c5e7b027ce76480f4c8ed0360c8fa5961e8a17bbb799be40048cd17110eafa2fb4bd5c4fa755b6a7813123
+  metadata.gz: b7946c6e1585492f3f6e05e153893ef54b403e2850844ecafa228408d2f03168cd12e61cfdbe33735145d3d047b07375911e09b3c7b5bef52c5fd8978a0f80c1
+  data.tar.gz: 88bd249512da994cb367ec337be1e0ca9a986f017f1a911cbe5d4cd45f2880ff9fad63a68563b8d90fecdd3000f265b3048ef5d88155868f6c9aee20a3a74f06

data/CHANGELOG

@@ -1,3 +1,21 @@
+Release 5.1.11
+--------------
+
+ * [Apache] Fixes a race condition (segfault) on startup, which primarily affected macOS hosts (regression in 5.1.8 due to the logging improvements). Closes GH-1973.
+ * [Apache] Fixes compilation on macOS 10.13 High Sierra.
+ * [Nginx] It is now allowed to specify `passenger_enabled` in the `http` context as well.
+ * [Nginx] Namespaced Jsoncpp under the Passenger namespace to avoid collisions with Google Pagespeed's copy when linked into Nginx.
+ * [Standalone] Enables HTTP/2 support in the Nginx template. Support is only active if SSL is used, to avoid potential issues with HTTP/2 on HTTP ports. Closes GH-1945.
+ * [Enterprise, Standalone] Adds a new feature that is especially useful on Heroku: deferred port binding. When `--defer-port-binding` is set, Passenger does not listen on the given port until the application has finished spawning. If the application starts slowly then this mechanism can prevent the Heroku request timeout from killing the dyno (the boot timeout still applies).
+ * [Enterprise, Standalone] Fixes duplicate warnings when Passengerfile.json contains errors.
+ * [Standalone] `passenger start` now accepts the `--start-timeout` configuration option.
+ * Adds support for Bundler 2.0's new `gems.rb` and `gems.locked`. Learn more about these in [Gemfile's new clothes](https://depfu.com/blog/2017/09/06/gemfiles-new-clothes). Closes GH-1982.
+ * Removes Debian packages for Ubuntu 12.04 Precise.
+ * Fixes compilation warnings on macOS + Clang 9.0.
+ * Introduces a new check that logs a vulnerability warning if Passenger is run with root permissions while the directory permissions of (parts of) its root dir allow modifications by non-root users.
+ * Fixes an arbitrary file read vulnerability (if Passenger is running as root and the attacker has access to a user account that hosts an application).
+
+
 Release 5.1.10
 --------------
 

data/Rakefile

@@ -1,5 +1,5 @@
 #  Phusion Passenger - https://www.phusionpassenger.com/
-#  Copyright (C) 2008-2016  Phusion Holding B.V.
+#  Copyright (C) 2008-2017  Phusion Holding B.V.
 #
 #  "Passenger", "Phusion Passenger" and "Union Station" are registered
 #  trademarks of Phusion Holding B.V.
@@ -38,25 +38,28 @@ if defined?(Bundler)
   end
 end
 
+def require_build_system_file(name)
+  require "#{SOURCE_ROOT}/build/#{name}"
+end
+
 require("#{SOURCE_ROOT}/config") if File.exist?("#{SOURCE_ROOT}/config.rb")
-require 'build/basics'
+require_build_system_file 'basics'
 if boolean_option('ONLY_RUBY')
-  require 'build/ruby_extension'
+  require_build_system_file 'ruby_extension'
 else
-  require 'build/ruby_extension'
-  require 'build/common_library'
-  require 'build/agent'
-  require 'build/apache2'
-  require 'build/nginx'
-  require 'build/documentation'
-  require 'build/packaging'
-  require 'build/test_basics'
-  require 'build/oxt_tests'
-  require 'build/cxx_tests'
-  require 'build/ruby_tests'
-  require 'build/node_tests'
-  require 'build/integration_tests'
-  require 'build/misc'
+  require_build_system_file 'ruby_extension'
+  require_build_system_file 'common_library'
+  require_build_system_file 'agent'
+  require_build_system_file 'apache2'
+  require_build_system_file 'nginx'
+  require_build_system_file 'packaging'
+  require_build_system_file 'test_basics'
+  require_build_system_file 'oxt_tests'
+  require_build_system_file 'cxx_tests'
+  require_build_system_file 'ruby_tests'
+  require_build_system_file 'node_tests'
+  require_build_system_file 'integration_tests'
+  require_build_system_file 'misc'
 end
 
 #### Default tasks

data/bin/passenger-install-apache2-module

@@ -49,7 +49,6 @@ PhusionPassenger.require_passenger_lib 'constants'
 PhusionPassenger.require_passenger_lib 'platform_info/ruby'
 PhusionPassenger.require_passenger_lib 'platform_info/operating_system'
 PhusionPassenger.require_passenger_lib 'platform_info/linux'
-PhusionPassenger.require_passenger_lib 'platform_info/macos'
 PhusionPassenger.require_passenger_lib 'platform_info/apache'
 PhusionPassenger.require_passenger_lib 'platform_info/apache_detector'
 PhusionPassenger.require_passenger_lib 'abstract_installer'
@@ -77,10 +76,8 @@ class Installer < PhusionPassenger::AbstractInstaller
       'cc',
       'c++',
       'libcurl-dev',
-      'openssl-dev',
       'zlib-dev',
       'apache2',
-      'apache2-dev',
       'rake',
       'ruby-openssl',
       'rubygems'
@@ -91,25 +88,29 @@ class Installer < PhusionPassenger::AbstractInstaller
       end
       ids << 'rack'
     end
+    # On macOS our Crypto.cpp uses TransportSecurity instead of OpenSSL.
+    if PlatformInfo.os_name_simple != 'macosx'
+      ids << 'openssl-dev'
+    end
+    if PlatformInfo.apxs2_needed_for_building_apache_modules?
+      ids << 'apache2-dev'
+    end
     # Some broken servers don't have apr-config or apu-config installed.
     # Nevertheless, it is possible to compile Apache modules if Apache
     # was configured with --included-apr. So here we check whether
     # apr-config and apu-config are available. If they're not available,
     # then we only register them as required dependency if no Apache
     # module can be compiled without their presence.
-    if needs_apr_and_apu
+    if needs_apr_and_apu?
       ids << 'apr-dev'
       ids << 'apu-dev'
     end
     return [specs, ids]
   end
 
-  def needs_apr_and_apu
-    ((PlatformInfo.apr_config && PlatformInfo.apu_config) ||
-     PlatformInfo.apr_config_needed_for_building_apache_modules?) &&
-      (PlatformInfo.apxs2 == '/usr/sbin/apxs' &&
-       (PlatformInfo.os_name_simple != "macosx" ||
-       PlatformInfo.macos_version < 12))
+  def needs_apr_and_apu?
+    (PlatformInfo.apr_config && PlatformInfo.apu_config) ||
+     PlatformInfo.apr_config_needed_for_building_apache_modules?
   end
 
   def install_doc_url
@@ -260,8 +261,10 @@ private
           :other_installs => other_installs
         puts
         if interactive?
+          # @apache.apxs2 can be nil, which on macOS >= 10.13 High Sierra
+          # means that we're using the OS-provided Apache installation.
           result = prompt_confirmation "Are you sure you want to install " +
-            "against Apache #{@apache2.version} (#{@apache2.apxs2})?"
+            "against Apache #{@apache2.version} (#{@apache2.apxs2 || 'OS-provided install'})?"
           if !result
             puts
             line

data/build/agent.rb

@@ -22,13 +22,13 @@
 #  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 #  THE SOFTWARE.
 
-AGENT_TARGET = "#{AGENT_OUTPUT_DIR}#{AGENT_EXE}"
+AGENT_TARGET = "#{AGENT_OUTPUT_DIR}#{PhusionPassenger::AGENT_EXE}"
 AGENT_MAIN_OBJECT = "#{AGENT_OUTPUT_DIR}AgentMain.o"
 AGENT_OBJECTS = {
   AGENT_MAIN_OBJECT =>
     "src/agent/AgentMain.cpp",
-  "#{AGENT_OUTPUT_DIR}AgentBase.o" =>
-    "src/agent/Shared/Base.cpp",
+  "#{AGENT_OUTPUT_DIR}AgentFundamentals.o" =>
+    "src/agent/Shared/Fundamentals/Implementation.cpp",
   "#{AGENT_OUTPUT_DIR}WatchdogMain.o" =>
     "src/agent/Watchdog/WatchdogMain.cpp",
   "#{AGENT_OUTPUT_DIR}CoreMain.o" =>
@@ -37,8 +37,6 @@ AGENT_OBJECTS = {
     "src/agent/Core/ApplicationPool/Implementation.cpp",
   "#{AGENT_OUTPUT_DIR}CoreController.o" =>
     "src/agent/Core/Controller/Implementation.cpp",
-  "#{AGENT_OUTPUT_DIR}UstRouterMain.o" =>
-    "src/agent/UstRouter/UstRouterMain.cpp",
   "#{AGENT_OUTPUT_DIR}SystemMetricsMain.o" =>
     "src/agent/SystemMetrics/SystemMetricsMain.cpp",
   "#{AGENT_OUTPUT_DIR}TempDirToucherMain.o" =>
@@ -47,28 +45,54 @@ AGENT_OBJECTS = {
     "src/agent/SpawnPreparer/SpawnPreparerMain.cpp"
 }
 
+# Agent-specific compiler flags.
+let(:agent_cflags) do
+  result = []
+  result << '-O' if OPTIMIZE
+  result << '-DUSE_SELINUX' if USE_SELINUX
+  result << '-flto' if LTO
+  result << PlatformInfo.adress_sanitizer_flag if USE_ASAN
+  result.join(' ')
+end
+
+# Agent-specific linker flags.
+let(:agent_ldflags) do
+  result = []
+  result << '-O' if OPTIMIZE
+  result << '-flto' if LTO
+  result << PlatformInfo.adress_sanitizer_flag if USE_ASAN
+  result << '-lselinux' if USE_SELINUX
+  # Extra linker flags for backtrace_symbols() to generate useful output (see agent/Base.cpp).
+  result << PlatformInfo.export_dynamic_flags
+  # Enable dead symbol elimination on OS X.
+  result << '-Wl,-dead_strip' if PlatformInfo.os_name_simple == 'macosx'
+  result.join(' ')
+end
+
 # Define compilation tasks for object files.
 AGENT_OBJECTS.each_pair do |object, source|
   define_cxx_object_compilation_task(
     object,
     source,
-    :include_paths => [
-      "src/agent",
-      *CXX_SUPPORTLIB_INCLUDE_PATHS
-    ],
-    :flags => [
-      AGENT_CFLAGS,
-      LIBEV_CFLAGS,
-      LIBUV_CFLAGS,
-      PlatformInfo.curl_flags,
-      PlatformInfo.zlib_flags
-    ]
+    lambda { {
+      :include_paths => [
+        "src/agent",
+        *CXX_SUPPORTLIB_INCLUDE_PATHS
+      ],
+      :flags => [
+        agent_cflags,
+        libev_cflags,
+        libuv_cflags,
+        PlatformInfo.curl_flags,
+        PlatformInfo.zlib_flags
+      ]
+    } }
   )
 end
 
 # Define compilation task for the agent executable.
 agent_libs = COMMON_LIBRARY.
-  only(:base, :bas64, :union_station_filter, :other).
+  only(:base, :base64, :union_station_filter, :process_management_ruby, :other).
   exclude('WatchdogLauncher.o')
 dependencies = AGENT_OBJECTS.keys + [
   LIBBOOST_OXT,
@@ -91,11 +115,14 @@ file(AGENT_TARGET => dependencies) do
       PlatformInfo.zlib_libs,
       PlatformInfo.crypto_libs,
       PlatformInfo.portability_cxx_ldflags,
-      AGENT_LDFLAGS
+      agent_ldflags
     ]
   )
 end
 
+desc 'Build the agent'
+task :agent => AGENT_TARGET
+
 task 'common:clean' do
   sh "rm -rf #{AGENT_OUTPUT_DIR}"
 end

data/build/apache2.rb

@@ -50,27 +50,43 @@ APACHE2_AUTOGENERATED_SOURCES = %w(
   src/apache2_module/SetHeaders.cpp
 )
 
+let(:apache2_cflags) do
+  result = [PlatformInfo.apache2_module_cflags]
+  result << '-O' if OPTIMIZE
+  result.join(' ')
+end
+
+let(:apache2_cxxflags) do
+  result = [PlatformInfo.apache2_module_cxxflags]
+  result << '-O' if OPTIMIZE
+  result.join(' ')
+end
+
 # Define compilation tasks for object files.
 APACHE2_OBJECTS.each_pair do |object, source|
   if source =~ /\.c$/
     define_c_object_compilation_task(
       object,
       source,
-      :include_paths => [
-        "src/agent",
-        *CXX_SUPPORTLIB_INCLUDE_PATHS
-      ],
-      :flags => PlatformInfo.apache2_module_cflags
+      lambda { {
+        :include_paths => [
+          "src/agent",
+          *CXX_SUPPORTLIB_INCLUDE_PATHS
+        ],
+        :flags => apache2_cflags
+      } }
     )
   else
     define_cxx_object_compilation_task(
       object,
       source,
-      :include_paths => [
-        "src/agent",
-        *CXX_SUPPORTLIB_INCLUDE_PATHS
-      ],
-      :flags => PlatformInfo.apache2_module_cxxflags
+      lambda { {
+        :include_paths => [
+          "src/agent",
+          *CXX_SUPPORTLIB_INCLUDE_PATHS
+        ],
+        :flags => apache2_cxxflags
+      } }
     )
   end
 end
@@ -79,12 +95,12 @@ end
 APACHE2_MODULE_BOOST_OXT_LIBRARY, APACHE2_MODULE_BOOST_OXT_LINKARG =
   define_libboost_oxt_task("apache2",
     APACHE2_OUTPUT_DIR + "module_libboost_oxt",
-    PlatformInfo.apache2_module_cflags)
+    lambda { PlatformInfo.apache2_module_cflags })
 APACHE2_MODULE_COMMON_LIBRARIES  = COMMON_LIBRARY.
-  only(:base, :bas64, 'AppTypes.o').
+  only(:base, :base64, 'AppTypes.o').
   set_namespace("apache2").
   set_output_dir(APACHE2_OUTPUT_DIR + "module_libpassenger_common").
-  define_tasks(PlatformInfo.apache2_module_cflags).
+  define_tasks(lambda { PlatformInfo.apache2_module_cxxflags }).
   link_objects
 dependencies = [
   APACHE2_MODULE_COMMON_LIBRARIES,
@@ -92,7 +108,6 @@ dependencies = [
   APACHE2_OBJECTS.keys
 ].flatten
 file(APACHE2_TARGET => dependencies) do
-  PlatformInfo.apxs2.nil?      and raise "Could not find 'apxs' or 'apxs2'."
   PlatformInfo.apache2ctl.nil? and raise "Could not find 'apachectl' or 'apache2ctl'."
   PlatformInfo.httpd.nil?      and raise "Could not find the Apache web server binary."
 
@@ -103,8 +118,9 @@ file(APACHE2_TARGET => dependencies) do
       APACHE2_MODULE_COMMON_LIBRARIES,
       APACHE2_MODULE_BOOST_OXT_LINKARG,
       PlatformInfo.apache2_module_cxx_ldflags,
-      PlatformInfo.portability_cxx_ldflags
-    ]
+      PlatformInfo.portability_cxx_ldflags,
+      OPTIMIZE ? '-O' : nil
+    ].compact
   )
 end
 

data/build/basics.rb

@@ -43,12 +43,19 @@ PhusionPassenger.require_passenger_lib 'platform_info/crypto'
 PhusionPassenger.require_passenger_lib 'platform_info/compiler'
 PhusionPassenger.require_passenger_lib 'platform_info/cxx_portability'
 
-include PhusionPassenger
-include PhusionPassenger::PlatformInfo
+PlatformInfo = PhusionPassenger::PlatformInfo
+SHORT_PROGRAM_NAME = PhusionPassenger::SHORT_PROGRAM_NAME
+PhusionPassenger::SharedConstants.constants.each do |name|
+  Kernel.const_set(name, PhusionPassenger::SharedConstants.const_get(name))
+end
 
-require 'build/support/cxx_dependency_map'
-require 'build/support/general'
-require 'build/support/cplusplus'
+if File.exist?("#{SOURCE_ROOT}/build/support/cxx_dependency_map.rb")
+  require_build_system_file 'support/cxx_dependency_map'
+else
+  CXX_DEPENDENCY_MAP = {}
+end
+require_build_system_file 'support/general'
+require_build_system_file 'support/cplusplus'
 
 if string_option('OUTPUT_DIR')
   OUTPUT_DIR = string_option('OUTPUT_DIR') + "/"
@@ -56,7 +63,6 @@ else
   OUTPUT_DIR = "buildout/"
 end
 
-verbose true if !boolean_option('REALLY_QUIET')
 if boolean_option('STDERR_TO_STDOUT')
   # Just redirecting the file descriptor isn't enough because
   # data written to STDERR might arrive in an unexpected order
@@ -82,11 +88,10 @@ PACKAGE_VERSION = PhusionPassenger::VERSION_STRING
 MAINTAINER_NAME  = "Phusion"
 MAINTAINER_EMAIL = "info@phusion.nl"
 
-CC       = maybe_wrap_in_ccache(PhusionPassenger::PlatformInfo.cc)
-CXX      = maybe_wrap_in_ccache(PhusionPassenger::PlatformInfo.cxx)
-LIBEXT   = PlatformInfo.library_extension
-USE_DMALLOC = boolean_option('USE_DMALLOC')
-USE_EFENCE  = boolean_option('USE_EFENCE')
+let(:cc) { maybe_wrap_in_ccache(PhusionPassenger::PlatformInfo.cc) }
+let(:cxx) { maybe_wrap_in_ccache(PhusionPassenger::PlatformInfo.cxx) }
+let(:libext) { PlatformInfo.library_extension }
+
 USE_ASAN    = boolean_option('USE_ASAN')
 USE_SELINUX = boolean_option('USE_SELINUX')
 OPTIMIZE    = boolean_option('OPTIMIZE')
@@ -98,40 +103,24 @@ CXX_SUPPORTLIB_INCLUDE_PATHS = [
   "src/cxx_supportlib/vendor-modified"
 ]
 
-# Agent-specific compiler flags.
-AGENT_CFLAGS  = ""
-AGENT_CFLAGS << " -O" if OPTIMIZE
-AGENT_CFLAGS << " -DUSE_SELINUX" if USE_SELINUX
-AGENT_CFLAGS << " -flto" if LTO
-AGENT_CFLAGS << " #{PlatformInfo.adress_sanitizer_flag}" if USE_ASAN
-AGENT_CFLAGS.strip!
-
-# Agent-specific linker flags.
-AGENT_LDFLAGS = ""
-AGENT_LDFLAGS << " -O" if OPTIMIZE
-AGENT_LDFLAGS << " -flto" if LTO
-AGENT_LDFLAGS << " #{PlatformInfo.dmalloc_ldflags}" if USE_DMALLOC
-AGENT_LDFLAGS << " #{PlatformInfo.electric_fence_ldflags}" if USE_EFENCE
-AGENT_LDFLAGS << " #{PlatformInfo.adress_sanitizer_flag}" if USE_ASAN
-AGENT_LDFLAGS << " -lselinux" if USE_SELINUX
-# Extra linker flags for backtrace_symbols() to generate useful output (see agent/Base.cpp).
-AGENT_LDFLAGS << " #{PlatformInfo.export_dynamic_flags}"
-# Enable dead symbol elimination on OS X.
-AGENT_LDFLAGS << " -Wl,-dead_strip" if PlatformInfo.os_name_simple == "macosx"
-AGENT_LDFLAGS.strip!
-
 # Extra compiler flags that should always be passed to the C/C++ compiler.
 # These should be included first in the command string, before anything else.
 EXTRA_PRE_CFLAGS = compiler_flag_option('EXTRA_PRE_CFLAGS')
 EXTRA_PRE_CXXFLAGS = compiler_flag_option('EXTRA_PRE_CXXFLAGS')
 # These should be included last in the command string.
-EXTRA_CFLAGS = PlatformInfo.default_extra_cflags.dup
-EXTRA_CFLAGS << " " << compiler_flag_option('EXTRA_CFLAGS') if !compiler_flag_option('EXTRA_CFLAGS').empty?
-EXTRA_CXXFLAGS = PlatformInfo.default_extra_cxxflags.dup
-EXTRA_CXXFLAGS << " " << compiler_flag_option('EXTRA_CXXFLAGS') if !compiler_flag_option('EXTRA_CXXFLAGS').empty?
-[EXTRA_CFLAGS, EXTRA_CXXFLAGS].each do |flags|
-  flags << " -fno-omit-frame-pointers" if USE_ASAN
-  flags << " -DPASSENGER_DISABLE_THREAD_LOCAL_STORAGE" if !boolean_option('PASSENGER_THREAD_LOCAL_STORAGE', true)
+let(:extra_cflags) do
+  result = PlatformInfo.default_extra_cflags.dup
+  result << " " << compiler_flag_option('EXTRA_CFLAGS') if !compiler_flag_option('EXTRA_CFLAGS').empty?
+  result << " -fno-omit-frame-pointer" if USE_ASAN
+  result << " -DPASSENGER_DISABLE_THREAD_LOCAL_STORAGE" if !boolean_option('PASSENGER_THREAD_LOCAL_STORAGE', true)
+  result
+end
+let(:extra_cxxflags) do
+  result = PlatformInfo.default_extra_cxxflags.dup
+  result << " " << compiler_flag_option('EXTRA_CXXFLAGS') if !compiler_flag_option('EXTRA_CXXFLAGS').empty?
+  result << " -fno-omit-frame-pointer" if USE_ASAN
+  result << " -DPASSENGER_DISABLE_THREAD_LOCAL_STORAGE" if !boolean_option('PASSENGER_THREAD_LOCAL_STORAGE', true)
+  result
 end
 
 # Extra linker flags that should always be passed to the linker.